Threats, Threat Sources, and Vulnerabilities EHE Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A security analyst is explaining to management why a vulnerability with a low CVSS score still poses a significant risk. The vulnerability is a default password on a network printer that is accessible only from the internal network. Which reasoning is most accurate?

   • AThe CVSS score is the only factor that matters for risk.
   • BThe vulnerability is a configuration issue, so it is not a real risk.
   • CThe printer may hold sensitive data, and an insider could exploit the default password to access it.
   • DThe vulnerability is not exploitable because it is internal.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which of the following scenarios best illustrates a threat in information security?

   • AThe company's firewall is misconfigured, allowing unauthorized access
   • BAn employee leaves their workstation unlocked while away from their desk
   • CA hacker with the intent to steal customer data from a company's database
   • DThe company suffered a data breach last year, losing sensitive records
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   An organization is assessing potential threat sources. Which of the following correctly categorizes a threat source?

   • AA hacker is an internal threat source
   • BA power outage is a human threat source
   • CAn earthquake is a natural threat source
   • DA contractor is an external threat source
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A company is deciding whether to invest in a vulnerability management program. They have a mix of technical, configuration, and human-factor vulnerabilities. Which statement best explains why addressing vulnerabilities is important even if no specific threat has been identified?

   • AVulnerabilities are unavoidable, so investing in management is not worthwhile.
   • BVulnerabilities are the same as threats, so addressing them eliminates all potential attacks.
   • CVulnerabilities are only important if a threat has been identified, otherwise there is no risk.
   • DVulnerabilities are weaknesses that can be exploited by a variety of threats, and reducing them lowers the overall risk even if the specific threat is unknown.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   In the context of information security, what is the most accurate definition of a threat?

   • AThe actual damage caused by a security breach
   • BThe likelihood that a specific attack will occur
   • CA weakness in a system that could be exploited by an attacker
   • DA potential cause of an unwanted incident that may result in harm to a system or organization
   Reveal Solution Discussion Select an answer first